Anti-Money Laundering (AML) Policy & Procedures

Scope: this policy applies to all employees, directors, contractors, and third-party service providers involved with Owave, including campaign organizers and platform operators.

Regulatory framework:

• Money Laundering (Prohibition) Act 2011 (as amended)
• Terrorism (Prevention) Act 2011 (as amended)
• Central Bank of Nigeria (CBN) AML/CFT Regulations
• Special Control Unit Against Money Laundering (SCUML) Guidelines
• Financial Action Task Force (FATF) Recommendations

The Board oversees AML compliance and ensures sufficient resources are allocated to mitigate money laundering and terrorist financing risks, including approving and reviewing AML policies, supporting the independence of the Money Laundering Reporting Officer (MLRO), and ensuring compliance risks are effectively managed.

The MLRO oversees day-to-day AML compliance: reviewing and investigating suspicious activity reports, filing Suspicious Transaction Reports (STRs) with the NFIU, maintaining AML training programs, conducting periodic risk assessments, liaising with regulators and law enforcement, and ensuring access to campaign, donor, and transaction records.

Until a full compliance team is established, AML compliance functions are handled by the Acting MLRO with support from designated staff, covering KYC and identity verification, BVN and government ID screening, transaction and campaign monitoring, whistleblowing and fraud reporting support, and record maintenance.

Owave adopts a risk-based approach to identify, assess, and mitigate AML/CFT risks across its platform operations, reviewed at least annually, upon major platform changes, and following regulatory or threat updates.

Customer risk: politically exposed persons (PEPs), high-value or recurring donors, high-risk jurisdictions.

Transaction risk: large or unusual donations, rapid spikes in campaign funding, withdrawals inconsistent with campaign purpose, use of multiple accounts.

Geographic risk: countries with weak AML controls, FATF high-risk or monitored jurisdictions.

Donor verification: standard due diligence includes full legal name, email address, phone number, and payment method verification. Enhanced due diligence (which may include ID verification, liveness checks, and MLRO approval) applies to high-value or recurring donors and donors in high-risk jurisdictions.

Campaign organizer verification: full legal name, a verified bank account matching BVN, a government-issued ID and utility bill, campaign purpose and description, and KYC of at least one board member for business accounts.

Ongoing monitoring: continuous monitoring of donor and campaign activity, with periodic updates to customer information.

We use automated and manual monitoring to detect threshold structuring, rapid funding spikes, inconsistent withdrawals, and multi-account fund routing. Investigations are initiated within 24 to 48 hours, documented, and escalated to the Acting MLRO. Withdrawals are permitted only to verified bank accounts matching BVN and company records.

Staff must report suspicious activity immediately. The Acting MLRO evaluates and files Suspicious Transaction Reports with the NFIU within 7 days. Currency Transaction Reports are filed for transactions exceeding regulatory thresholds. Tipping-off is strictly prohibited.

Users are screened against UN Security Council, OFAC, Nigerian sanctions, and PEP lists at onboarding, during high-value transactions, and quarterly thereafter. Positive matches result in immediate transaction holds and escalation.

All donor, campaign, transaction, STR, and CTR records are retained securely for a minimum of 5 years and made available for regulatory inspection.

AML training is provided during onboarding and annually thereafter, with specialized training for the Acting MLRO and compliance staff. We conduct annual internal audits and external independent audits at least every two years, with findings reported to the Board and remediated promptly. This policy is reviewed annually or upon significant regulatory change.

Non-compliance may result in disciplinary action including warnings, retraining, suspension, termination, regulatory fines, license revocation, or prosecution.

Questions about this AML Policy can be sent to hello@owave.co.